need sugestions about login

I got it working but....

[supermanjnk]

Okay I got my login working, to an extent. The problem is is that mysql is storing passwords in the form of hex, and when you go to log in you have to put in the password in hex, not what it really is, which is going to be rather hard for people who need to log in. I'm using the user database for PHPBB, so i am wondering if maybe PHPBB Has something in it to convert it from hex to characters, because I know I don't have to put in my password in hex to log into PHPBB

mysql_connect($host ,$user,$pass) or die("Unable to connect to database");
mysql_select_db("$db") or die("Unable to select database $db");
if (!isset($PHP_AUTH_USER)) {

// If empty, send header causing dialog box to appear

header('WWW-Authenticate: Basic realm="Please Log In"');
header('HTTP/1.0 401 Unauthorized');
exit;

} else if (isset($PHP_AUTH_USER)) {

// Formulate the query

$sql = "SELECT * FROM $utable WHERE username='$PHP_AUTH_USER' and user_password='$PHP_AUTH_PW'";

// Execute the query and put results in $result

$result = mysql_query($sql);

// Get number of rows in $result. 0 if invalid, 1 if valid.

$num = mysql_num_rows($result);

if ($num!= "0") {
header("Location: test2.php");
exit;

} else {

header('WWW-Authenticate: Basic realm="Perhaps you mistyped something, please try again."');
header('HTTP/1.0 401 Unauthorized');
echo 'Authorization Required.';
exit;

}

}

?>

[coopster]

I don't use PHPBB, but I will venture to guess that it is storing passwords in a hash, not actual text, when a new user is setup. This is a common security practice. Maybe somebody else that is familiar with PHPBB knows for sure, but I'm guessing you may have to compare the password to the hashed value.

$sql = "SELECT * FROM $utable WHERE username='$PHP_AUTH_USER' and user_password='" . md5 [php.net]($PHP_AUTH_PW) . "'";

[ergophobe]

Yes, coopster is right

[phpbb.com...]

Tom